# Anomaly Analysis

> Scan a dataset for significant anomalies — outliers, distribution shifts, impossible values, and unusual groupings. Use when the user wants a first-pass integrity and anomaly sweep of a CSV/Parquet/Excel file before deeper analysis.

- **Type:** Skill
- **Install:** `agentstack add skill-danielrosehill-claude-data-analyst-plugin-anomaly-analysis`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [danielrosehill](https://agentstack.voostack.com/s/danielrosehill)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [danielrosehill](https://github.com/danielrosehill)
- **Source:** https://github.com/danielrosehill/Claude-Data-Analyst-plugin/tree/master/skills/anomaly-analysis

## Install

```sh
agentstack add skill-danielrosehill-claude-data-analyst-plugin-anomaly-analysis
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Anomaly Analysis

Identify significant anomalies in a dataset across three layers: value-level, distribution-level, and relational.

## Inputs

- Path to a dataset file or folder.
- Optional: timestamp column name (enables temporal anomaly checks).
- Optional: group-by column (for per-segment anomaly detection).

## Recommended CLI tooling

- `duckdb` — percentile, z-score, and windowed queries.
- `uv run --with pandas --with scikit-learn python -c '...'` — IsolationForest and LOF for multivariate anomalies.
- `csvstat` (csvkit) — quick min/max/null sanity check.

## Procedure

### Layer 1 — Value-level sanity

For each column:
- Nulls: count and percentage; flag columns >20% null.
- Duplicates: flag rows duplicated on a natural key, or full-row duplicates.
- Impossible values: negative ages, dates in the future, percentages >100, etc. Use column name hints.
- Type coherence: mixed types in one column (e.g. numbers stored as strings with stray text).

### Layer 2 — Distribution-level outliers

For each numeric column:
- **IQR method**: flag values below Q1 − 1.5·IQR or above Q3 + 1.5·IQR.
- **Z-score**: flag |z| > 3.
- **Top/bottom 5**: list the extreme values explicitly so the user can eyeball them.

For categorical columns:
- Rare categories (-anomalies.md`:

1. **Summary**: one-line severity (low / medium / high) and headline anomaly count.
2. **By layer**: sections for value-level, distribution, and multivariate.
3. **Evidence**: concrete example rows (with row numbers / keys) for each flagged anomaly.
4. **Recommendations**: which anomalies warrant investigation vs. are likely expected tail behaviour.

Be specific — "17 rows have negative `order_total`" is useful; "there are some outliers" is not.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [danielrosehill](https://github.com/danielrosehill)
- **Source:** [danielrosehill/Claude-Data-Analyst-plugin](https://github.com/danielrosehill/Claude-Data-Analyst-plugin)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-danielrosehill-claude-data-analyst-plugin-anomaly-analysis
- Seller: https://agentstack.voostack.com/s/danielrosehill
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.